IBM API Connect from versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 allows a remote, authenticated attacker to execute arbitrary code by altering object attributes that should be system‑controlled. The flaw arises when an attacker sets a prohibited field, enabling code execution within the API Connect environment. This presents a high‑impact vulnerability that can compromise the confidentiality, integrity, and availability of systems relying on API Connect.

Affected installations include IBM API Connect 10.0.8.0 to 10.0.8.12 and 12.1.0.0 to 12.1.1.2. IBM recommends upgrading to the latest 12.1.1.3 release or to 10.0.8.13 to address the issue.

The CVSS score of 9.9 indicates critical severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the lack of a KEV entry suggests no widespread active exploitation yet. The attack vector is inferred to be remote, requiring authenticated access to the API Connect administration interface. An attacker with legitimate credentials can set disallowed fields, leading to code execution. The combination of high severity and the need for authentication means that environments with exposed API Connect services or weak internal access controls are at elevated risk.